JP6916762B2 - Method determination device, method determination method and method determination program - Google Patents

Description

The present invention relates to devices, methods and programs for authenticating users.

Conventionally, various services have been provided via a communication network. These services are equipped with an authentication function that confirms the identity of the user in order to prevent fraud such as spoofing. A wide variety of authentication methods can be adopted for this authentication function, but the service provider usually decides which authentication method to use.
Patent Document 1 proposes a method of determining an authentication method based on the security required by a service and the situation at the time of authentication.

JP-A-2017-45328

However, in the conventional method, a complicated authentication procedure may always be required for a user who repeatedly logs in, which poses a problem in convenience.

An object of the present invention is to provide a method determination device, a method determination method, and a method determination program capable of determining a convenient authentication method while ensuring safety.

The method determining device according to the present invention identifies the user based on the collecting unit that collects a predetermined type of user information indicating the state of the user from the authentication terminal associated with the user in advance and the user information. A learning unit that generates a classifier for the user, and the user himself / herself who acquires the user information from the authentication terminal when executing the authentication of the user and is calculated by the classifier using the user information. It includes a determination unit that determines the security level required for the authentication based on the characteristics, and a selection unit that selects a method suitable for the security level from a plurality of authentication methods.

When the user makes an authentication request from a login terminal different from the authentication terminal, the collection unit acquires the identification information of the login terminal, and the learning unit obtains the identification information of the login terminal, and the learning unit is based on the user information and the identification information. The classifier may be generated.

The method determining device includes a state determination unit that determines the current state of the user based on the user information, and the selection unit may select a method suitable for the determined current state. ..

The learning unit may generate the discriminator based on the difference from the information of another user different from the user.

The method determining device may include a priority acquisition unit that acquires priority information of the plurality of authentication methods registered by the user, and the selection unit may select a method based on the priority information.

The method determining device includes a usability acquisition unit that acquires usability information for each method including the time until the authentication succeeds or the number of failures, and the selection unit selects a method based on the usability information. May be good.

The method determining method according to the present invention identifies the user based on a collection step of collecting a predetermined type of user information indicating the state of the user from an authentication terminal associated with the user in advance and the user information. The user himself / herself who acquires the user information from the authentication terminal when executing the authentication of the user and the learning step of generating the classifier for the purpose, and is calculated by the classifier using the user information. The computer executes a determination step of determining the security level required for the authentication based on the characteristics and a selection step of selecting a method suitable for the security level from a plurality of authentication methods.

The method determining program according to the present invention identifies the user based on a collection step of collecting a predetermined type of user information indicating the state of the user from an authentication terminal associated with the user in advance and the user information. The user himself / herself who acquires the user information from the authentication terminal when executing the authentication of the user and the learning step of generating the classifier for the purpose, and is calculated by the classifier using the user information. This is for causing a computer to perform a determination step of determining the security level required for the authentication based on the nature and a selection step of selecting a method suitable for the security level from a plurality of authentication methods. ..

According to the present invention, a convenient authentication method can be determined.

It is the schematic which shows the structure of the whole authentication system which concerns on embodiment. It is a figure which shows the functional structure of the method determination apparatus which concerns on embodiment. It is a sequence diagram which illustrates the process at the time of the user authentication in the authentication system which concerns on embodiment.

Hereinafter, an example of the embodiment of the present invention will be described.
FIG. 1 is a schematic view showing the configuration of the entire authentication system 100 including the method determination device 1 according to the present embodiment.

The user uses a login terminal 3 that receives a service provided by the service providing server 2 and an authentication terminal 4 that provides information for performing user authentication at the time of login. In the present embodiment, the authentication terminal 4 is separate from the login terminal 3 and is assumed to be a mobile terminal such as a smartphone or a tablet terminal, but the present invention is not limited to this, and the login terminal 3 also serves as the authentication terminal 4. You may be.

The method determination device 1 periodically acquires the information of the authentication terminal 4 via the terminal management server 5, and generates a classifier for identifying the identity of the user by learning. The method determining device 1 uses this classifier to determine the identity of the user who made the authentication request, and selects an authentication method according to the determination result.

The login terminal 3 or the authentication terminal 4 executes various authentication processes with the terminal management server 5 by using the authentication method selected by the method determination device 1 in order to log in to the service providing server 2. The authentication result is notified to the service providing server 2, and access from the login terminal 3 is permitted.

Here, the authentication method includes, for example, the following, but the authentication method is not limited to these, and various authentication methods may be used. Further, a plurality of methods may be combined and a multi-step authentication method may be used.
・ Password authentication ・ 4-digit password authentication ・ 8-digit password authentication ・ Pattern authentication ・ Authentication using secret questions ・ One-time password authentication ・ One-time pattern authentication ・ SIM authentication ・ Device authentication ・ Using private key Authentication by signature ・ Authentication by random number table ・ Palm print authentication ・ Fingerprint authentication ・ Face authentication ・ Palm vein authentication ・ Finger vein authentication ・ Iridescent authentication ・ Voice authentication ・ Signature authentication ・ Multi-element authentication ・ Image authentication (CAPTCHA)
・ Location authentication ・ Risk-based authentication ・ Multi-path authentication

Each of these authentication methods is considered to have a risk of unauthorized access, and a security level that can guarantee the legitimacy of the user is set for each. Further, the required security level is set by the service provider according to the content of the service provided by the service providing server 2.
The method determination device 1 selects an authentication method for satisfying the security level set by the service provider.

FIG. 2 is a diagram showing a functional configuration of the method determination device 1 according to the present embodiment.
The method determination device 1 is an information processing device (computer) such as a personal computer or a server provided with a control unit 10 and a storage unit 20, and further provides an interface function with a user and an external device such as an input / output device and a communication interface. Have.

The control unit 10 functions as the following units by reading and executing the software (method determination program) stored in the storage unit 20.
That is, the control unit 10 includes a collection unit 11, a learning unit 12, a determination unit 13, a state determination unit 14, a priority acquisition unit 15, a usability acquisition unit 16, and a selection unit 17.

The collecting unit 11 collects a predetermined type of user information indicating the state of the user from the authentication terminal 4 associated with the user in advance.
As a method of associating the user with the authentication terminal 4, the terminal used in the past authentication may be automatically associated with the user, or the user himself / herself may register the authentication terminal 4. The association information may be stored in the storage unit 20, or may be stored in an external terminal management server 5 or the like.

Examples of user information include the following types of data.
-Location information such as IP address, base station ID, GPS positioning information, etc.
-Measured values of various sensors provided in the authentication terminal 4, such as an acceleration sensor, a proximity sensor, and a brightness sensor.
-A means of transportation such as stationary, walking, or a car, which is determined using the above various data.

The collecting unit 11 periodically acquires these user information from the user authentication terminal 4, and provides the learning unit 12 together with the date and time information. Further, the collecting unit 11 may further acquire the information at the time when the user requests the authentication and provide it to the learning unit 12 as the information specialized at the time of authentication.

Further, when the user makes an authentication request from a login terminal 3 different from the authentication terminal 4, the collection unit 11 acquires identification information including the IP address and location information of the login terminal 3 and provides it to the learning unit 12. You may.

The learning unit 12 generates a classifier for identifying a user based on the user information and the identification information. An existing learning method may be used as a means for generating the classifier.
As a result, data characterizing the behavior of each user is formed by learning, and a score indicating personality is calculated according to when, where, and what state the login terminal 3 and the authentication terminal 4 are in.
At this time, the learning unit 12 can also improve the identification accuracy of the user by generating the classifier based on the difference from the information of another user different from the target user.

When executing user authentication, the determination unit 13 inputs the user information newly acquired from the authentication terminal 4 into the classifier, and based on the calculated score indicating the user's identity, the security required for authentication. Determine the level.
The security level required by the provided service may be set according to the calculated score indicating the identity. That is, if the identity is low, a higher security level is required, but if the identity is high, even if the authentication has a relatively low security level, it is necessary in combination with the calculated score indicating the identity. Security level is guaranteed.

The state determination unit 14 determines the current state of the user based on the user information.
For example, the state determination unit 14 is based on various sensor information, such as whether the place where the user is located is a bright place or a dark place, a quiet place or a noisy place, what is the means of transportation, and the like. Determine the state.
A discriminator for each user may be used for determining this state, or a discriminator common to a plurality of users may be used. Further, the state determination unit 14 may determine the state based on a threshold value prepared in advance.

The priority acquisition unit 15 acquires priority information of a plurality of authentication methods registered in advance by the user. For example, the method determination device 1 accepts a plurality of authentication methods to be used from the user and designations such as ranking or points, and registers them as setting information for each user.

The usability acquisition unit 16 acquires usability information for each method including the time required for the user to succeed in authentication by any authentication method or the number of failures. This usability information indicates the suitability for each authentication method for each user, and is acquired each time authentication is executed.

The selection unit 17 selects a method suitable for the security level from among a plurality of authentication methods. Here, a security level is set for each of the plurality of authentication methods, and an authentication method in which a level equal to or higher than the security level determined by the determination unit 13 is set is selected.

Further, the selection unit 17 selects an authentication method suitable for the determined current state of the user from among the authentication methods satisfying the security level.
For example, since voice authentication is difficult on a train, fingerprint authentication or the like is selected. Alternatively, since face authentication is difficult in a dark place, fingerprint authentication using another sensor or the like is selected.
These selection logics are registered in the storage unit 20 in advance.

Further, the selection unit 17 selects the authentication method based on the priority information acquired by the priority acquisition unit 15 and the usability information acquired by the usability acquisition unit 16.
At this time, for example, if a user gives priority to fingerprint authentication but has a high failure rate, a selection method that emphasizes usability rather than user preference (priority), such as selecting palm print authentication with a high success rate, is used. There may be.

Further, the selection unit 17 acquires information on the priority setting change by the user himself and combines it with the usability information to avoid one authentication method due to many failures or simply because he likes or dislikes it, and another. It can be determined that the authentication method is desired. Then, for example, if the ranking of a certain authentication method is lowered simply by preference, the selection unit 17 may select an authentication method contrary to the setting in order to maintain the security level.

FIG. 3 is a sequence diagram illustrating a process at the time of user authentication in the authentication system 100 according to the present embodiment.
Prior to this process, it is assumed that the method determining device 1 periodically acquires user user information from the authentication terminal 4 in advance, and a classifier for each user is generated.

In step S1, the login terminal 3 makes a service request to the service providing server 2 in response to an instruction input from the user.
In step S2, the service providing server 2 makes a redirect request to the method determination device 1 to the requesting login terminal 3 in order to authenticate the user who requested the service.
In step S3, the login terminal 3 notifies the method determination device 1 of the user ID and makes an authentication request in accordance with the redirect request.

In step S4, the method determination device 1 notifies the terminal management server 5 of the user ID for which the authentication request has been made.
In step S5, the terminal management server 5 identifies the authentication terminal 4 associated with the user ID in advance.

In step S6, the terminal management server 5 transmits the ID of the specified authentication terminal 4 to the notification server responsible for the push notification, and requests the push notification.
In step S7, the notification server performs a push notification for requesting user information to the designated authentication terminal 4.
In step S8, the authentication terminal 4 acquires user information by invoking a predetermined application in response to receiving the push notification.
In step S9, the authentication terminal 4 transmits the acquired user information to the terminal management server 5.

In step S10, the terminal management server 5 transfers the received user information to the method determination device 1.
In step S11, the method determining device 1 inputs the received user information into the classifier for each user and acquires a score indicating the identity. Then, when the method determining device 1 determines the security level according to the risk indicated by this score, the method determining device 1 selects an authentication method satisfying this security level.

In step S12, the terminal management server 5 executes an authentication process with the authentication terminal 4 or the login terminal 3 by using the authentication method selected by the method determination device 1.
In step S13, the terminal management server 5 notifies the service providing server 2 of the authentication result.

In step S14, the terminal management server 5 makes a redirect request for the login terminal 3 to access the service providing server 2.
In step S15, the login terminal 3 makes a service request to the service providing server 2 in response to the redirect request.
In step S16, the service providing server 2 provides a predetermined service to the login terminal 3 in response to the service request.

Here, the method determining device 1 periodically acquires user information for learning the classifier from the registered authentication terminal 4 via the terminal management server 5. At this time, steps S6 to S10 periodically acquire the user information. Is executed.
In this example, the process of performing push notification via the notification server is illustrated, but depending on the function of the authentication terminal 4 and the type of operating system, the trigger is triggered only once at the start or without going through the notification server. Then, a predetermined application may automatically send user information on a regular basis.

According to the present embodiment, the method determining device 1 collects user information from the authentication terminal 4 and generates a classifier for each user by learning, so that the user information acquired again when executing authentication is input. Calculate a score that indicates your identity. The method determination device 1 determines the security level required for authentication based on the score indicating the identity, and selects a method suitable for this security level.

From the user information acquired by the mobile authentication terminal 4, for example, frequently visited location information such as work place, commuting route, business place, overseas base, etc. is learned, so if the position at the time of authentication is different from the learning content. The risk of personality is high, but it can be estimated that the risk is low if it matches the learning content.
Therefore, the method determining device 1 can secure the same security even if the necessary security level is relaxed by confirming the identity by using the user information at the time of non-authentication at the time of authentication. As a result, the method determining device 1 can determine a convenient authentication method while ensuring safety.

When the login terminal 3 is different from the authentication terminal 4, the method determination device 1 is used for learning the classifier by acquiring identification information such as an IP address and location information from the login terminal 3.
Therefore, the method determining device 1 can improve the accuracy of the classifier by collecting abundant information at the time of non-authentication and at the time of authentication.

The method determination device 1 can select an authentication method suitable for this state by determining the current state of the user based on the user information at the time of authentication. As a result, the method determining device 1 can flexibly change the authentication method depending on the situation and improve convenience.

Since the method determining device 1 generates a discriminator based on the difference from the information of another user, the discriminating accuracy can be improved by using the peculiar information different from the target user.

By using the setting information regarding the priority order, the method determining device 1 can select an authentication method according to the user's preference while maintaining the security level, and can improve convenience.

The method determination device 1 can select an authentication method according to a procedure that is easy for the user to perform by using the usability information for each authentication method including the time until the authentication succeeds or the number of failures, and the convenience can be improved.

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Moreover, the effects described in the above-described embodiments are merely a list of the most preferable effects arising from the present invention, and the effects according to the present invention are not limited to those described in the embodiments.

The method of determining the method by the method determining device 1 is realized by software. When realized by software, the programs that make up this software are installed in the information processing device (computer). Further, these programs may be recorded on a removable medium such as a CD-ROM and distributed to the user, or may be distributed by being downloaded to the user's computer via a network. Further, these programs may be provided to the user's computer as a Web service via a network without being downloaded.

1 Method determination device 2 Service providing server 3 Login terminal 4 Authentication terminal 5 Terminal management server 10 Control unit 11 Collection unit 12 Learning unit 13 Decision unit 14 Status determination unit 15 Priority acquisition unit 16 Usability acquisition unit 17 Selection unit 20 Storage unit 100 Authentication system

Claims (7)

A collection unit that collects a predetermined type of user information indicating the state of the user from an authentication terminal associated with the user in advance.
A learning unit that generates a classifier for identifying the user based on the user information,
When executing the authentication of the user, the user information is acquired from the authentication terminal, and the security level required for the authentication is based on the identity of the user calculated by the classifier using the user information. And the decision-making part that decides
It is equipped with a selection unit that selects a method that suits the security level from among a plurality of authentication methods .
When the user makes an authentication request from a login terminal different from the authentication terminal, the collection unit acquires the identification information of the login terminal.
The learning unit is configured based on the user information and the identification information, the classifier that generates a scheme determining apparatus. A state determination unit for determining the current state of the user based on the user information is provided.
The method determining device according to claim 1, wherein the selection unit selects a method suitable for the determined current state. The method determining device according to claim 1 or 2 , wherein the learning unit generates the classifier based on a difference from information of another user different from the user. A priority acquisition unit for acquiring priority information of the plurality of authentication methods registered by the user is provided.
The method determining device according to any one of claims 1 to 3 , wherein the selection unit selects a method based on the priority information. It is provided with a usability acquisition unit that acquires usability information for each method including the time until the authentication succeeds or the number of failures.
The method determining device according to any one of claims 1 to 4 , wherein the selection unit selects a method based on the usability information. A collection step of collecting a predetermined type of user information indicating the state of the user from an authentication terminal associated with the user in advance.
A learning step of generating a classifier for identifying the user based on the user information,
When executing the authentication of the user, the user information is acquired from the authentication terminal, and the security level required for the authentication is based on the identity of the user calculated by the classifier using the user information. The decision step to decide and
The computer executes a selection step of selecting a method suitable for the security level from a plurality of authentication methods .
In the collection step, when the user makes an authentication request from a login terminal different from the authentication terminal, the identification information of the login terminal is acquired.
A method for determining a method for generating the classifier based on the user information and the identification information in the learning step. A collection step of collecting a predetermined type of user information indicating the state of the user from an authentication terminal associated with the user in advance.
A learning step of generating a classifier for identifying the user based on the user information,
When executing the authentication of the user, the user information is acquired from the authentication terminal, and the security level required for the authentication is based on the identity of the user calculated by the classifier using the user information. The decision step to decide and
A computer is made to execute a selection step of selecting a method suitable for the security level from a plurality of authentication methods .
In the collection step, when the user makes an authentication request from a login terminal different from the authentication terminal, the identification information of the login terminal is acquired.
In the learning step, based on said user information and said identification information, because the method determination program to generate the identifier.

Images